1. Technical Field
This invention relates to the field of network security and in particular networked user authentication systems.
2. Related Art
One industry standard for achieving strong user authentication to network services is the Kerberos system, as described in Miller S. P., Neuman B. C., Schiller J. I., & Salitzer J. H. “Kerberos Authentication and Authorisation System”, M.I.T Project Athena, Cambridge, Mass., December 1987. Kerberos uses a trusted third-party authentication service in which each client trusts the Kerberos central server to authenticate other clients. Timestamps are used on each client-server communication to prevent or at least reduce the chance of a replay attack.
The Kerberos server maintains a database of its clients and their private keys and an encrypted password for users. Any network services or clients requiring authentication must register with the Kerberos server. The private keys are then negotiated at registration. Kerberos can also provide secure session management based on session keys. The Kerberos system has proven to be a useful authentication platform but suffers from the need for a single centralised server, which is frequently the target of attacks, since access gives full control of a network. It also requires expert administration for its maintenance.
Some preliminary agent based work in this field has already demonstrated the effectiveness of agent managed security methods, although primarily in the area of intrusion detection, (e.g. Filman R., and Linden T., “Communicating Security Agents”, Proc. WET ICE 1996, Yialelis, Lupo & Sloman 1996, Balasubramaniyan J., Jose Omar Garcia-Fernandez, Spafford E., and Zamboni D. “An Architecture for Intrusion Detection using Autonomous Agents”, Department of Computer Sciences, Purdue University; Coast TR 98-05; 1998). In particular work by Heirlier G. G., Wong J. S., Honavar V., and Miller L. “Intelligent agents for intrusion detection”. In Proceedings, IEEE Information Technology Conference, pages 121-124, Syracuse, N.Y., September 1998, demonstrated a multi-agent network defence system in which software agents monitor low-level network activity and report it to higher-level software agents for analysis.
In the system proposed by Crosbie and Spafford (1995) (Crosbie M. and Spafford E. “Defending a Computer System using Autonomous Agents”, In 18th National Information Systems Security Conference, October 1995), a similar distributed set of agents monitors network traffic and machine activity, including CPU utilisation. Their system also has agents exchanging anomaly reports between each other and decisions to raise an intrusion alert are based on the combined evidence from a number of agents. This system also utilises a form of machine learning based on Genetic Programs in order to recognise new patterns of attack. Work by Carver et al (2000) (Carver C. A., Hill J. M., Surdu J. R., and Pooch U. W., “A Methodology for using Intelligent Agents to provide Automated Intrusion Response,” IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, West Point, N.Y., Jun. 6-7 2000, pp. 110-116), demonstrates the use of a distributed heterogeneous group of agents as an IDS solution. The focus is on dynamic and adaptive response to varying levels of security threats.
Qi He and Sycara K. P. and Zhongmin Su, “A Solution to Open Standard of PKI”, book, Australasian Conference on Information Security and Privacy, pages 99-110, 1998 demonstrates the use of encrypted KQML message exchange among a networked group of agents, which is used as a secure PKI (Public Key Infrastructure) certificate management scheme.
One commercial system, which utilises a similar web and agent based authentication method is the ‘ProviderTrust’ Web Access system from seqID Ltd. This is a single agent system, designed to provide authentication within a single Intranet domain. Rothke B., “Security Strategies for E-Companies, an insiders view”, Information & Security Magazine, October 2001, describes another security system.
In summary, existing systems suffer from several failings, e.g. centrally based key management, which is a potential target for malicious attacks; limited scalability, due to centralised processing of the user database; high operational cost due to the frequent manual intervention required, to reset passwords, and revoke or issue digital certificates.